Executive brief
Claude Code is a developer tool that enables AI-assisted coding within repositories. A vulnerability allowed malicious repository settings to trigger API calls before users confirmed whether they trusted the repository, potentially exposing their Anthropic API credentials to an attacker-controlled server. An attacker who controls a repository could steal API keys from developers who open that repository in Claude Code.
Technical details
The vulnerability stems from improper trust-confirmation ordering in Claude Code's project-load flow. When a user opens a repository containing a malicious `.env` or settings file that overrides ANTHROPIC_BASE_URL to an attacker-controlled endpoint, Claude Code would issue API requests (including the user's API key) before displaying the trust/confirmation prompt to the user. The attack requires the attacker to control a Git repository and the user to open it with Claude Code; no additional privileges or authentication are required. An attacker can exfiltrate credentials including Anthropic API keys. The vulnerability has been patched in version 2.0.65; auto-update users have already received the fix.
Affected products
- Anthropic Claude Code < 2.0.65
Timeline
- 2026-01-21: disclosed
- 2026-01-21: patched: version 2.0.65